Weird Issue Cracking 128-bit RC4 Acrobat 6.0 PDF from Acrobat 10.0 Paper Capture Plug
#4
After analyzing this problem more carefully it seems that the only problem is the longer /ID element size *32* vs *16* (jtr does already load - and crack - this).

An example from here https://hashcat.net/wiki/doku.php?id=example_hashes shows that oclHashcat currently expects an id size of 16 bytes ($pdf$2*3*128*-1028*1*16* ... therefore something like $pdf$2*3*128*-1028*1*32*... is currently not supported, or in your case: $pdf$4*4*128*-1324*1*32*.... (note: the 32, it is not *16*).

If you want to request support for longer /ID elements in oclHashcat, you should open an enhancement trac ticket here: https://hashcat.net/trac/ (and link this thread)


Messages In This Thread
RE: Weird Issue Cracking 128-bit RC4 Acrobat 6.0 PDF from Acrobat 10.0 Paper Capture Plug - by philsmd - 03-02-2015, 02:05 AM